Switzerland Prepares for AI Regulation
Switzerland will enter 2027 without its own version of the EU AI Act. The Federal Council is taking a different approach, using existing laws where possible and adding new rules only where it sees gaps.
The next step comes at the end of 2026, when the government is due to publish a consultation draft. Current plans point to rules on transparency, data protection, discrimination and supervision, with separate measures possible for sectors such as healthcare and transport.
Swiss companies still have time to prepare, but many of the rules they need to think about already exist.
Svizzera already applies existing law to AI systems when they process personal data, affect individuals or create other legal obligations. At the same time, Swiss companies selling into the EU may already fall under parts of the EU AI Act that became enforceable on 2 August 2026. The two systems are beginning to overlap before Switzerland has passed its own AI legislation.
Bern has chosen a sector-led model
The Federal Council set out its direction in February 2025 and confirmed that Switzerland intends to ratify the Council of Europe Framework Convention on Artificial Intelligence. Switzerland signed the convention on 27 March 2025.
The treaty deals with AI in relation to human rights, democracy and the rule of law. Implementing it in Switzerland will require legal changes, but Bern has resisted copying the EU model.
Instead, existing Swiss laws will carry much of the load. New cross-sector rules are expected only where the Federal Council sees a common need, including transparency and protection against discrimination.
A bank, hospital and online retailer could therefore use the same underlying AI model and still face different requirements because of how they use it.
The Federal Office of Communications is also preparing non-binding measures, including industry solutions and voluntary commitments. These are due alongside the legislative work by the end of 2026.
That date marks the arrival of the consultation draft, not the start of a new law. Parliament and the normal Swiss political process will follow.
Companies are already using AI at scale
While Bern works on legislation, AI has moved into daily business use.
An EY survey published through the federal SME portal in July 2026 questioned 604 employees in Switzerland. It found that 89% used AI tools daily. Some 55% said their employer had already introduced AI strategically in at least one business area, while another 31% described their company as being in a pilot phase.
Only 14% said their employer had not started a concrete AI initiative.
Microsoft Copilot and Google Gemini were used by 70% of respondents. More strikingly, 29% said they were allowed to use AI through personal accounts such as ChatGPT.
That is where policy becomes less abstract.
A marketing employee may paste campaign figures into one tool. HR may use another to prepare an applicant summary. A sales employee may upload meeting notes to a personal AI account. Several providers can start handling company or client information before anyone has made a complete list of the systems in use.
The same EY survey found that 19% of respondents saw security and data protection as barriers to adoption. Another 20% pointed to data quality and data silos. More than half, 51%, said AI systems should comply fully with Swiss or European data protection standards.
Swiss data law already applies
The Federal Data Protection and Information Commissioner has been clear on one point: when an AI system processes personal data, the Swiss Data Protection Act applies.
Companies may already need to know what information enters a system, why it is processed and where it goes. High-risk processing can require a data protection impact assessment. Automated individual decisions may also trigger rights for the person affected, including circumstances in which they can request human review.
The legal exposure changes with the use.
An employee using an approved AI assistant to correct an internal text presents a different case from a recruitment system ranking applicants. A customer chatbot collecting names, contact details and business information creates another set of data questions.
The law may be old in relation to the technology. The obligations are not suspended while Switzerland writes new AI rules.
The EU timetable has already started
For some Swiss companies, Brussels is moving faster than Bern.
The EU AI Act can apply to providers outside the European Union when they place an AI system or general-purpose AI model on the EU market. It can also apply when the output of a system run outside the EU is used inside the Union.
A Swiss software company selling an AI product in Germany may therefore fall within the Act even if its developers and servers are in Switzerland.
Parts of the legislation are already in force.
Rules on prohibited AI practices and AI literacy started to apply in February 2025. Requirements for general-purpose AI models followed in August 2025. From 2 August 2026, authorities began enforcing further parts of the Act, including new transparency requirements.
Certain chatbots must disclose that the user is interacting with AI. Providers of some systems generating synthetic text, images, video or audio face marking and detection duties. Deepfakes can require disclosure.
The penalty framework is also in place. Breaches of transparency and several other operator obligations can carry fines of up to €15 million or 3% of worldwide annual turnover, depending on the infringement and the rules applying to SMEs. Prohibited practices can carry higher maximum fines of up to €35 million or 7% of worldwide turnover.
More high-risk system requirements will follow later, including rules scheduled for 2027 and 2028.
A Swiss company therefore cannot answer the regulatory question simply by saying that Switzerland has not yet passed an AI Act.
Find out what the company already uses
Before preparing for legislation that has not yet been published, companies can map the systems already inside the business.
The obvious names are ChatGPT, Copilot and Gemini. AI is also appearing inside CRM systems, recruitment software, analytics platforms, advertising tools, design applications and customer support products. Some suppliers have added AI features to software their clients bought long before generative AI became mainstream.
The inventory does not need to be complicated. Record which system is used, who uses it, what data enters it, whether personal or confidential information is involved and what the provider does with that information.
A company selling into the EU needs another detail: where the system or its output is used. A tool used only inside a Swiss company may fall outside the EU AI Act, while a product sold in the EU or producing output used there may need to be reviewed under the European rules.
Contracts with software suppliers are another place to look. Companies need to know whether their data is used for model training, where it is processed, which subcontractors are involved and how long the provider keeps it.
Employees need rules they can remember without opening a twenty-page policy. Which tools are approved? Which information must never go into public AI systems? When must an output be checked by a person? When does a customer need to know that AI is involved?
If 89% of surveyed Swiss employees are already using AI daily, most companies are not preparing for a future technology. They are trying to put rules around behaviour that has already started.
Before the Swiss draft arrives
The consultation expected by the end of 2026 should show where the Federal Council wants to amend existing law and which obligations it intends to apply across sectors.
Companies do not need to wait for that document to establish the basics. By the end of this year, they can know which AI systems are in use, which ones handle personal or confidential data, who approved them, where suppliers process information and whether any products or outputs enter the EU.
Automated decisions affecting employees, applicants or customers deserve a separate review. Client-facing AI should be checked against disclosure requirements. New software purchases should include questions about AI before the contract is signed, not after the feature appears in the interface.
Switzerland’s final rules will take time. The EU rules are already arriving in stages. The companies in the weakest position will be those still trying to work out where AI is being used when the next set of obligations lands.
